Germany faces two power-grid sabotage cases as Leipzig drone attack fuels Russian hybrid-war fears

German authorities are investigating two suspected sabotage attacks on electricity infrastructure within 24 hours, intensifying security concerns one day after Berlin formally accused Russia of directing an attempted explosives-laden drone attack at Leipzig/Halle Airport. The latest incident targeted a substation near Bergheim in western Germany, where deliberate interference forced five lignite-fired generating units with a combined capacity of 4,200 megawatts off the grid, although officials said regional electricity supplies remained stable. A separate attack in Brandenburg involved devices that damaged high-voltage infrastructure near the Jänschwalde power plant, one of the most important electricity nodes in eastern Germany. Authorities have not established who carried out either grid attack and have explicitly avoided attributing them to Russia, but the incidents are increasing pressure on Germany and the European Union to strengthen defenses against sabotage, drones and other forms of hybrid warfare.

The timing has made the security implications particularly difficult to ignore. Germany concluded on September 1 that Russian state agencies were behind an August 4 attempt to attack Leipzig/Halle Airport with an explosive-equipped drone, an accusation Moscow strongly denies. European Commission President Ursula von der Leyen said on September 2 that Europe would increase pressure on Russia, while EU foreign policy chief Kaja Kallas said the Leipzig incident carried the hallmarks of state-sponsored terrorism. The combination of a suspected state-backed drone operation and two separate domestic power-grid attacks is forcing Germany to confront how vulnerable civilian infrastructure could become during an era in which military confrontation increasingly occurs below the threshold of conventional war.

Bergheim sabotage temporarily removes 4,200 MW of German power generation from the grid

German police said the incident at the Bergheim substation near Cologne occurred on September 1 and appeared to involve deliberate interference with technical infrastructure rather than an accidental malfunction. Investigators described it as premeditated vandalism and opened a criminal investigation into how the substation was disrupted.

The immediate effect was substantial even though households did not experience a widespread blackout. Energy company RWE said five lignite-fired generating units connected through the site were forced offline, representing approximately 4,200 MW of combined generating capacity. One 600 MW unit was subsequently reconnected, while electricity-grid operator Amprion said grid stability and power supplies were maintained throughout the incident.

That distinction matters because successful sabotage does not necessarily need to plunge a major city into darkness to impose economic or operational costs. Temporarily removing several gigawatts of generation forces grid operators to compensate elsewhere, requires emergency technical work and demonstrates that an attacker can disrupt critical infrastructure without causing catastrophic physical destruction.

Germany’s electricity grid is designed with redundancy precisely to absorb failures in individual plants, lines or substations. The Bergheim incident nevertheless shows how substations can represent strategically important points where interference affects multiple generating units simultaneously.

Police have not publicly identified suspects or established a motive. Authorities have also avoided linking the Bergheim attack directly with the separate incident in Brandenburg, although officials say the proximity in timing is being examined as investigators compare methods and evidence.

Explosive devices near Jänschwalde power plant trigger separate sabotage and terrorism investigation

The other incident occurred at the Turnow-Preilack substation near the Jänschwalde coal-fired power plant in Brandenburg. Multiple improvised devices were discovered around the facility, with some causing short circuits and damage to power lines while others apparently failed to function as intended.

No widespread power outage followed, but the location increased authorities’ concern because the substation is connected with one of Brandenburg’s most important power-generation sites. The facility forms part of the high-voltage network responsible for moving large quantities of electricity across eastern Germany.

Brandenburg Interior Minister Jan Redmann said investigators could not rule out involvement by a foreign power, but he stressed that the inquiry remains at an early stage and no perpetrator has been established. He also noted possible similarities with previous politically motivated attacks while cautioning that investigators were examining multiple possibilities.

Germany has faced previous attacks on electricity infrastructure from domestic extremists. A 2024 arson attack associated with far-left militants disrupted power supplies to Tesla’s factory near Berlin, and other high-voltage infrastructure has subsequently been targeted. That history means foreign involvement is only one of several possibilities investigators must examine before reaching conclusions about the latest incidents.

The importance of maintaining that distinction is particularly high because the attacks coincide with a major confrontation between Berlin and Moscow. Germany has directly attributed the Leipzig airport incident to Russian state activity, but it has made no comparable finding concerning the power substations.

Germany says Russian state agencies directed explosives-laden drone operation at Leipzig airport

The broader security alarm originates from an incident at Leipzig/Halle Airport on August 4. Airport personnel discovered a drone carrying explosives and a detonator near a runway, close to Ukrainian cargo operations at one of Germany’s most strategically important aviation facilities.

Leipzig/Halle is a major civilian freight hub but also has considerable security importance because it supports NATO logistics and hosts large Ukrainian Antonov An-124 cargo aircraft. A successful attack could therefore have affected commercial aviation while simultaneously damaging infrastructure connected with military support for Ukraine.

Germany initially investigated without publicly assigning responsibility. After weeks of police and intelligence work, Interior Minister Alexander Dobrindt announced on September 1 that authorities had concluded individuals involved in the operation were acting on behalf of Russian state agencies. He said the conclusion was based on investigative evidence, the method used and intelligence findings.

Russia denies involvement and says Germany has failed to publicly produce sufficient evidence supporting the accusation. Kremlin spokesperson Dmitry Peskov accused Berlin of escalating tensions, while the Russian Foreign Ministry has promised a response to Germany’s retaliatory measures.

The allegation is nonetheless significantly more serious than a conventional espionage accusation. Germany is effectively saying a foreign government supported an operation involving explosives at a major airport on German territory, creating the possibility of casualties and potentially affecting NATO-linked logistics.

Berlin closes Russian facilities and seeks wider EU action after Leipzig attribution

Germany has already announced diplomatic measures in response. Foreign Minister Johann Wadephul said Berlin would close Russia’s consulate general in Bonn and terminate the agreement allowing the Russian House cultural center to operate in Berlin.

The government also intends to seek additional EU sanctions listings, tighter travel restrictions on Russian nationals and greater pressure against Russia’s so-called shadow fleet. Western governments say those tankers help Moscow transport oil while avoiding sanctions and restrictions imposed following the invasion of Ukraine.

Berlin argues that Leipzig should be viewed as part of a wider pattern rather than an isolated intelligence operation. German officials say suspected Russian-linked activities across Europe increasingly target infrastructure, defense companies, political institutions and governments supporting Ukraine. Moscow rejects accusations that it is conducting a coordinated campaign of sabotage.

The disagreement reflects the ambiguity that makes hybrid operations strategically useful. Unlike a conventional missile strike carrying an obvious military signature, sabotage can involve proxies, covert operatives, cyber tools or commercially available drones, making attribution slower and politically more contested.

That allows attacks to impose costs while creating uncertainty about whether they cross the threshold that would justify a conventional military response. For NATO governments, finding credible proportional responses has consequently become one of the central challenges of confronting suspected hybrid warfare.

EU says Leipzig incident carries hallmarks of state-sponsored terrorism

European officials significantly hardened their language on September 2. Kallas said the Leipzig operation showed the characteristics of state-sponsored terrorism and argued that European governments must examine additional responses as Russian pressure against Ukraine and European countries intensifies.

Von der Leyen similarly promised that Europe and NATO would increase pressure rather than reduce support for Ukraine. After meeting NATO Secretary General Mark Rutte, she described the security environment created by Russian activity as a new reality requiring European governments to respond faster and strengthen their defenses.

Rutte said NATO had recorded more drones and missiles crossing into allied airspace on Europe’s eastern flank alongside increasing malign activity. He argued that attempts to divide European countries or deter their support for Kyiv would fail.

EU foreign ministers are now considering additional sanctions aimed at Russia’s military-industrial network. Kallas said work was already underway involving roughly 1,600 sanctions listings connected with Russia’s military complex, while several foreign ministers indicated that more individuals or entities could be added.

France is also pushing for additional measures targeting Russia’s shadow fleet. Other governments have revived discussions over whether approximately €210 billion in immobilized Russian central-bank assets should play a larger role in financing Ukraine, although legal and financial concerns remain unresolved.

Power-grid incidents expose limits of protecting sprawling European infrastructure

The two sabotage investigations raise a separate problem even if they eventually prove unrelated to Russia. Modern electricity networks contain thousands of substations, transmission lines, transformers and switching facilities spread across enormous geographic areas, making complete physical protection impossible.

E.ON Chief Executive Leonhard Birnbaum recently acknowledged that fully securing every element of the electricity network against deliberate attack is unrealistic. Operators can increase surveillance, redundancy and barriers, but attackers only need to identify vulnerable points while defenders must protect an enormous interconnected system.

That asymmetry has become more important as European governments strengthen traditional military defenses. An adversary seeking disruption without direct armed confrontation may find civilian energy networks, telecommunications, transportation systems or undersea infrastructure easier targets than military bases.

Germany is particularly sensitive because it is Europe’s largest economy and an essential logistics hub for NATO forces supporting the alliance’s eastern flank. Disruptions involving railways, airports or electricity networks can therefore create effects extending beyond German domestic life.

Officials must also distinguish foreign operations from domestic extremism, vandalism and ordinary technical failures. Incorrectly attributing an attack can create diplomatic consequences of its own, while waiting too long to respond to genuine hostile-state activity can encourage further operations.

German security crisis arrives days before closely watched Saxony-Anhalt election

The incidents are unfolding in an unusually sensitive political environment. Saxony-Anhalt holds a state election on September 6, and Reuters reported that the Alternative for Germany was leading recent polling with approximately 40% support compared with around 23% for Chancellor Friedrich Merz’s Christian Democratic Union.

The AfD advocates a substantially different Russia policy from the federal government, including reducing support for Ukraine and restoring closer economic relations with Moscow. Party co-leader Tino Chrupalla has criticized Berlin’s attribution of the Leipzig incident and accused the government of applying different standards when discussing attacks connected with Russia and Ukraine.

German authorities have not said the grid incidents are connected with the election, and there is currently no evidence establishing such a link. Their occurrence during the final days of campaigning nevertheless increases the political sensitivity surrounding every official statement about attribution and motive.

Hybrid operations are often intended not only to damage physical assets but also to increase political mistrust and deepen existing divisions. That makes accurate attribution and transparent evidence especially important when security incidents occur during an election period.

Germany’s response could shape how NATO treats future hybrid attacks below threshold of war

The longer-term significance extends beyond the individual substations or the Leipzig drone. European governments increasingly face incidents serious enough to create national-security concerns but deliberately calibrated below the level of conventional warfare.

NATO’s Article 5 collective-defense guarantee was designed primarily around armed attacks. Hybrid threats complicate that framework because sabotage, cyberattacks and covert operations can impose major costs without presenting the unmistakable battlefield conditions associated with an invasion or missile strike.

The practical response is increasingly likely to involve intelligence sharing, sanctions, infrastructure hardening, counter-sabotage operations and diplomatic retaliation rather than conventional military force. Germany’s closure of Russian facilities and the EU’s preparations for additional sanctions illustrate that emerging model.

The unresolved grid investigations will now become important tests of attribution. If authorities establish a domestic extremist or criminal motive, the incidents will primarily expose weaknesses in critical-infrastructure protection. If evidence eventually points to a foreign government, Europe would face a much more serious pattern involving simultaneous pressure against both transportation and energy systems.

Either outcome leaves Germany with the same immediate problem. Protecting a modern economy against sabotage requires defending infrastructure that was largely designed for reliability and efficiency rather than an era of sustained hybrid confrontation.

Key takeaways from Germany’s power-grid sabotage investigations and Leipzig drone crisis

• German authorities are investigating two suspected sabotage attacks against electricity infrastructure that occurred within approximately 24 hours.
• The Bergheim incident forced five RWE lignite generating units representing 4,200 MW of capacity offline, although the wider power grid remained stable.
• A separate attack near Brandenburg’s Jänschwalde power plant involved improvised devices and damaged high-voltage infrastructure without causing a major blackout.
• Authorities have not identified who carried out either grid attack and have not attributed the incidents to Russia.
• Germany separately concluded that Russian state agencies were responsible for an August 4 explosives-laden drone operation at Leipzig/Halle Airport.
• Russia denies the Leipzig accusation and says Berlin has not publicly produced evidence sufficient to establish Moscow’s involvement.
• Germany is closing Russia’s Bonn consulate and ending its agreement with the Russian House cultural center as part of its response.
• Kaja Kallas says the Leipzig incident carries hallmarks of state-sponsored terrorism, while the EU is preparing additional pressure on Russia.
• European officials are considering new sanctions, tighter measures against Russia’s shadow fleet and further action involving Moscow’s military-industrial network.
• The incidents highlight Europe’s growing challenge of protecting airports, electricity networks and other civilian infrastructure against attacks below the threshold of conventional war.